# \[PATCH iproute2\] ss: fix NULL dereference when rendering without header

- Subsystems: THE REST
- Maintainers: Linus Torvalds
- List: netdev
- 2 messages, 2 authors
- Page: https://ratatoskr.run/netdev/2018/03/11089708/t

## \[PATCH iproute2\] ss: fix NULL dereference when rendering without header

- From: Jean-Philippe Brucker \<hidden\>
- Date: 2018-03-03 17:01:48 
- Message: https://ratatoskr.run/netdev/2018/03/11089708.md

```text
When ss is invoked with the no-header flag, if the query doesn't return
any result, render() is called with 'buffer' uninitialized. This
currently leads to a segfault. Ensure that buffer is initialized before
rendering.

The bug can be triggered with: ss -H sport = 100000

Signed-off-by: Jean-Philippe Brucker <redacted>
---
 misc/ss.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/misc/ss.c b/misc/ss.c
index e047f9c0..e087bef7 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -1197,10 +1197,15 @@ newline:
 /* Render buffered output with spacing and delimiters, then free up buffers */
 static void render(int screen_width)
 {
-	struct buf_token *token = (struct buf_token *)buffer.head->data;
+	struct buf_token *token;
 	int printed, line_started = 0;
 	struct column *f;
 
+	if (!buffer.head)
+		return;
+
+	token = (struct buf_token *)buffer.head->data;
+
 	/* Ensure end alignment of last token, it wasn't necessarily flushed */
 	buffer.tail->end += buffer.cur->len % 2;
 
-- 
2.16.2
```

## Re: \[PATCH iproute2\] ss: fix NULL dereference when rendering without header

- From: Stefano Brivio \<hidden\>
- Date: 2018-03-03 17:36:03 
- Message: https://ratatoskr.run/netdev/2018/03/11089707.md

```text
On Sat,  3 Mar 2018 16:59:44 +0000
Jean-Philippe Brucker [ref] wrote:

> When ss is invoked with the no-header flag, if the query doesn't return
> any result, render() is called with 'buffer' uninitialized. This
> currently leads to a segfault. Ensure that buffer is initialized before
> rendering.
> 
> The bug can be triggered with: ss -H sport = 100000

Oh dear. Nice catch, thanks for fixing this.

> Signed-off-by: Jean-Philippe Brucker <redacted>

Acked-by: Stefano Brivio <redacted>

-- 
Stefano
```